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(54) Voltage monitoring circuit and memory card incorporating the same 



(57) A voltage monitoring circuit compares a volt- 
age, which is obtained by dividing the voltage required 
for writing or erasing data, with a reference voltage 
(Vref) by a comparator (13). and if the comparison result 
indicates that the voltage required for writing or erasing 



data is not being supplied, then it disables the operation 
of a CPU (4), thus enabling quick discovery of a failure 
of the supply of the voltage necessary for writing or 
erasing to a semiconductor storage. 




CM 
< 
CM 

CO 

CD 

O 

Q. 
LU 



AVAIUBB 



Puscd by Xona (UK) Bmjisca Scnra:o 
2 16 7/36 



LVSDOCID: <EP. _ . _0371312A2J_> 



1 EPO 971 312 A2 2 



Description 

BACKGROUND OF THE INVENTION 

1 . Field of the Invention 

[0001 ] The present invention relates to a voltage mon- 
itoring circuit for monitoring the voltage used for writing 
data to or erasing it from a semiconductor storage and, 
more particularly, to a voltage monitoring circuit 
intended for a semiconductor storage incorporated in a 
memory card or the like. 

2. Description of the Related Art 

[0002] Cards in which information can be recorded 
have been used in a variety of fields. The cards are 
available as magnetic cards for retaining necessary 
information in the form of magnetic information or as 
memory cards designed to store necessary information 
in semiconductor storages. The memory cards come in 
two types: one type has a built-in semiconductor stor- 
age, and the other type incorporates a program memory 
or the like for implementing required processing by 
accessing a central processing unit or other desired 
processing, the latter type is known as an IC card. Sem- 
iconductor devices built in the memory cards include 
dynamic random access memories or static random 
access memories that permit read and write (hereinaf- 
ter referred to as "RAM"), electrically erasable and pro- 
grammable read only memories (hereinafter referred to 
as "EEPROM"), and flash memories that permit erasure 
in block sizes. 

[0003] Generally, when a user of a memory card tries 
to use the memory card, the personal identification 
number of the user is checked to make sure that the 
person attempting to use it is the authorized user of the 
memory card. The IC card is available in two types: in 
one type of IC card, the personal identification number 
is checked on the card reader/writer side or the host 
side; in the other type, the check is performed within the 
IC card. The following describes an example of the 
checking procedure applied to the type of IC card 
adapted to check the personal identification number 
within the IC card. 

[0004] First, a personal identification number is 
entered through an input circuit provided on the surface 
of a card medium of the IC card. The entered personal 
identification number is checked against the personal 
identification number that has been stored in the IC card 
beforehand. When the check result indicates agree- 
ment, the use of the IC card is authorized to proceed to 
the subsequent processing such as referring to a trans- 
action history or other information that has already been 
stored in the IC card, if the check result indicates disa- 
greement, then the personal identification number is 
entered again to repeat the check. If the check result 
indicates disagreement for a predetermined number of 



times e.g. three in succession, then the subsequent 
processing of the (C card is disabled and the use of tie 
IC card itself is prohibited at the same time. The number 
of disagreements revealed by the check is stored and 

5 updated in a built-in semiconductor storage as the 
number of error count each time the check result shows 
the disagreement. Hence, when the error count number 
reaches the predetermined number e.g. three, the use 
of the (C card itself will be prohibited. 

10 [0005] To check the personal identification number for 
the IC card by using the card reader/writer, the IC card 
is inserted in the card reader/writer and the personal 
identification number is entered through the input circuit 
provided on the card reader/writer. The rest of the pro- 

15 cedure is identical to that mentioned above. 

[0006] Such a function prevents unauthorized use of 
an IC card obtained by a third person who has obtained 
the IC card by theft or the like unless the third person 
knows the authorized personal identification number of 

20 the IC card. The personal identification number is com- 
posed, for example, of a combination of a plurality of 
characters or numerals so that it cannot be guessed 
right within a predetermined number of attempts. Thus, 
the security of IC cards is maintained. 

25 [0007] As described above, the error count number is 
written to the semiconductor storage built in the IC card. 
For instance, to write data to or erase it from the IC card, 
a voltage, e.g. a high voltage of about 20 volts for an 
EEPROM, is required. If the supply of such a voltage to 

30 the semiconductor storage is prohibited due to the dam- 
age to a source generating the voltage required for writ- 
ing or erasing or due to disconnected wiring for 
supplying the voltage required for writing or erasing to 
the semiconductor storage, then writing or erasing the 

35 error count number is disabled. This applies not only to 
the IC cards but also to the memory cards that have 
built-in semiconductor storages requiring such a special 
voltage. 

[0008] If an unauthorized third party tries entering per- 
40 sonai identification numbers to use a card which has 
been reworked so that the supply of the voltage required 
for writing or erasing to a semiconductor storage is dis- 
abled, then the error count number is no longer written 
to or updated in the semiconductor storage. This ena- 
45 bles the check of a personal identification number to be 
performed for a number of times exceeding a predeter- 
mined number. This has been presenting a problem in 
that a third party may eventually find out a correct per- 
sonal identification number and unauthorized use of an 
so IC card or a memory card is permitted. 

SUMMARY OF THE INVENTION 

[0009] Accordingly, it is an object of the present inven- 
55 tion to provide a voltage monitoring circuit that permits 
quick discovery of the aforesaid failure of the supply of a 
voltage required for writing data to or erasing it from a 
semiconductor storage. 
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[001 0] It is another object of the present Invention to 
achieve accurate operation In the voltage monitoring cir- 
cuit. 

[001 1 ] It is still another object of the present invention 
to apply the voltage monitoring circuit to a memory card s 
so as to maintain security even if a memory card has 
been reworked to disable the supply of a voltage 
required for writing data to or erasing it from a semicon- 
ductor storage. 

[001 2] To these ends, according to one aspect of the 10 
present invention, there is provided a voltage monitoring 
circuit for monitoring a desired voltage, the voltage mon- 
itoring circuit having a detector circuit that detects 
whether the voltage used for writing data to or erasing it 
from a semiconductor storage is a permissible voltage 75 
and issues a control signal for controlling the operation 
of peripheral circuitry as the detection result. 
[001 3J The detector circuit in accordance with the 
present invention may have a comparing circuit that 
compares a voltage according to the desired voltage 20 
with a reference voltage and issues a signal indicative of 
the comparison result, and a retaining circuit that 
retains an output signal from the comparing circuit and 
issues a signal based on the output signal as a control 
signal. 25 
[001 4] The semiconductor storage in accordance with 
the present invention is a nonvolatile memory using a 
high voltage, which is higher than the line voltage, for 
writing or erasing; and the detector circuit may have a 
voltage dividing circuit which divides the supplied high 30 
voltage so as to compare the voltage divided through 
the voltage dividing circuit with the reference voltage by 
the comparing circuit. 

[0015] The detector circuit in accordance with the 
present invention may have a level changing circuit that 35 
changes the level of an activating signal, which corre- 
sponds to a line voltage, to high voltage level according 
to a high voltage generated externally and supplies the 
high voltage after the level change is supplied to a volt- 
age dividing circuit. 40 
[0016] Further, in the memory card incorporating the 
voltage monitoring circuit in accordance with the 
present invention, the data written to or erased from a 
part of the semiconductor storage is the number of 
times a personal identification number is checked; the 45 
checking of the personal identification number is carried 
out according to a first program stored in a semiconduc- 
tor storage for storing programs that is independently 
provided from the semiconductor storage, and the acti- 
vating signal is generated according to a second pro- so 
gram stored in the semiconductor storage for storing 
programs. 

[0017] In the semiconductor storage for storing pro- 
grams in the memory card according to the present 
invention, the first program, the second program, and a ss 
third program for carrying out the processing of access 
to an area of the semiconductor storage where the 
number ol checks of a personal identification number is 



written or erased are stored in a scattered manner. The 
second program is executed according to an instruction 
given by the first program, and the third program is exe- 
cuted by an instruction given by the second program. 

BRIEF DESCRIPTION OF THE DRAWINGS 
[0018] 

Fig. 1 is a circuit diagram of a voltage monitoring 
circuit (1 0) in a first embodiment in accordance with 
the present invention; 

Fig. 2 is a timing chart illustrating the operation of 
the voltage monitoring circuit (10) in the first 
embodiment in accordance with the present inven- 
tion; 

Fig. 3 is a flowchart showing the checking proce- 
dure of a personal identification number in an IC 
card; 

Fig. 4 is a circuit diagram of a voltage monitoring 
circuit (20) in a second embodiment of the present 
invention; and 

Fig. 5 is a diagram showing a program stored in a 
semiconductor storage (9) for storing programs in 
the second embodiment of the present invention. 

DESCRIPTION OF THE PREFERRED EMBODI- 
MENTS 

[0019] The voltage monitoring circuit in accordance 
with the present invention will be explained in detail in 
conjunction with the accompanying drawings. Figure 1 
is a circuit diagram of a voltage monitoring circuit 10 in 
a first embodiment An IC card will be used as the 
embodiment; hence, it is assumed that the voltage mon- 
itoring circuit 10 shown in Fig. 1 and the peripheral cir- 
cuitry thereof are included in the IC card. 
[0020] As illustrated in Fig. 1, provided inside the IC 
card are: a charge pump circuit 1 serving as a high-volt- 
age generating circuit that generates a high voltage Vpp 
(e.g. 20 volts) which is higher than a line voltage Vdd 
(e.g. 5 volts); a semiconductor storage 3 that stores, in 
a part thereof, the number of successive disagree- 
ments, i.e. the error count number, in the checking of a 
personal identification number; a central processing unit 
(hereinafter referred to as "CPU") 4 that reads out a 
desired program from a semiconductor storage 9 for 
storing programs for accessing the semiconductor stor- 
age 3 and other programs for implementing various 
types of processing in the card including the checking of 
personal identification numbers and updating transac- 
tion history information and controls other circuits in the 
IC card; and a voltage monitoring circuit 10. 
[0021 ] The charge pump circuit 1 boosts the line volt- 
age Vdd to the high voltage Vpp and transmits the high 
voltage Vpp to a line 6. The high voltage Vpp is supplied 
via the line 6 to the semiconductor storage 3 and the 
voltage monitoring circuit 10. 
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[0022] The semiconductor storage 3 uses the high 
voltage Vpp supplied through the line 6 to write data or 
erase written data. More specifically, in this embodi- 
ment, an EEPROM using high voltage for writing or 
erasing data is taken as an example of the semiconduc- 5 
tor storage 3. If the semiconductor storage 3 uses 
DRAM or the like that writes or erases on the line volt- 
age Vdd, then the charge pump circuit 1 is not required; 
in this case, the line voltage Vdd is supplied via the line 
6. 

[0023] The operation of the CPU 4 is controlled by the 
control signals issued by the voltage monitoring circuit 
10. For instance, when the voltage level of the control 
signal is a line voltage Vdd level (hereinafter referred to 
as "H level"), the operation of the CPU 4 is disabled, 
whereas when the voltage level of the control signal is a 
ground voltage Vss level (hereinafter referred to as "L 
level"), the operation of the CPU 4 is enabled (a state in 
which normal operation is enabled). The CPU 4 sup- 
plies a signal for controlling the operation of the semi- 
conductor storage 3, ag. a write signal or a read signal, 
to the semiconductor storage 3 via a line 8. 
[0024] The voltage monitoring circuit 1 0 has a dividing 
circuit composed of two capacitors 1 1 and 12, a compa- 
rator 13 which is a comparing circuit, and a D flip-flop 14 
which is a retaining circuit 

[0025] One end of the capacitor 1 1 is connected to the 
line 6, and the other end thereof is connected to a node 
n1. One end of me capacitor 12 is connected to the 
node n1 ; the ground voltage Vss (0 volt) is supplied to 
the other end thereof. In this embodiment, the ratio of 
the capacitance of the capacitor 1 1 to that of the capac- 
itor 1 2 is 1 to N (N is a positive integer). Hence, the volt- 
age at the node n1 is equal to the voltage at one end of 
the capacitor 11, namely, 1/(N+1) of the voltage sup- 
plied through the line 6. For example, if the voltage sup- 
plied through the line 6 is 20 volts and N = 9, then the 
voltage at the node n1 will be 20/(9 + 1) = 2 volte. 
[0026] As it will be discussed later, the comparator 13 
performs comparison with a reference voltage Vref 40 
according to the voltage at the node n1 . The high volt- 
age Vpp may be directly supplied to the comparator 13 
and compared with the reference voltage Vref; however, 
the high voltage is prone to be considerably affected by 
noises. For this reason, it is preferable to divide the high as 
voltage to accomplish more accurate comparison. 
Besides, using the high voltage Vpp as it is for the com- 
parison by the comparator 13 would require a high volt- 
age to be used for the reference voltage Vref. The 
reference voltage Vref should be least dependent upon so 
the line voltage Vdd, so that an extra system for boost- 
ing the reference voltage Vref would be necessary. 
Hence, it is more desirable to compare a voltage divided 
from the high voltage with the reference voltage Vref. 
[0027] Two capacitors are used for dividing the volt- ss 
age; or two resistive elements may be used instead. 
[0028] TTie voltage at the node n1 is supplied to the 
positive input end, which is one input terminal, of the 



comparator 13; and the reference voltage Vref is sup- 
plied through a line 15 to the negative input end, which 
is the other input terminal thereof. From the viewpoint of 
the accuracy of comparison, the reference voltage Vref 
should be least dependent upon the line voltage Vdd. 
The comparator 13 compares the two supplied voltages 
and outputs the comparison result For instance, if the 
reference voltage Vref is 2 volte and if the voltage to be 
obtained by the voltage division, i.e. the voltage at the 
node n1 . according to the reference voltage Vref should 
be 2 volts, then the comparator 13 issues the H-level 
output signal as a comparison result if the voltage at the 
node n1 has not reached 2 volts. If the voltage at the 
node n1 has reached 2 volte, then the comparator 13 
issues the L-level output signal as tie comparison 
result. 

[0029] A data input terminal D of the D flip-flop 14 
receives an output signal of the comparator 13 and a 
clock terminal thereof receives a trigger signal TRG via 
a line 16. When the D flip-flop 14 receives a clock pulse 
as the trigger signal TRG, it stores the signal applied to 
the data input terminal D in response to the rise of the 
clock pulse and issues a signal corresponding to a volt- 
age level, which is based on the stored signal, from an 
output terminal Q. For example, if the voltage level of 
the signal applied to the data input terminal D is H level, 
then a signal of H voltage level is issued from the output 
terminal Q; or if the voltage level of the signal applied to 
the data input terminal D is L level, then a signal of L 
voltage level is issued from the output terminal Q. The 
signals emitted from the output terminal Q provide the 
control signals which are the outputs of the voltage 
monitoring circuit 10. In this embodiment, the D flip-flop 
14 is employed as the retaining circuit; however, it may 
be replaced by a register or the like as long as it has 
similar performance. 

[0030] In the embodiment, the control signals which 
are the outputs of the voltage monitoring circuit 10 are 
supplied to the CPU 4 which is one of the peripheral cir- 
cuits; however, they may be used for other peripheral 
circuit such as the charge pump circuit 1 to control the 
boosting operation thereof. In this case, the control sig- 
nals disable the operation of the CPU 4 and the boost- 
ing operation as well; hence, the current consumed for 
boosting is reduced. Furthermore, even if the CPU 4 
should carry out unexpected processing by the disa- 
bling and the CPU 4 should fail to stop the operation of 
the charge pump circuit 1 , the operation of the charge 
pump circuit 1 can be securely controlled without 
depending on the CPU 4. 

[0031] The operation timing of the voltage monitoring 
circuit 10 will now be explained in conjunction with the 
accompanying drawings. 

[0032] Figure 2 shows a timing chart illustrative of the 
operation timing of the voltage monitoring circuit 10. It is 
assumed that a signal of the L voltage level is being 
emitted from the output terminal Q of the D flip-flop 14 in 
the initialized state. 
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[0033] First, in response to an instruction for writing or 
erasing data to or from the semiconductor storage 1 
given by the CPU 4, the operation of the charge pump 
circuit 1 is initiated at time to and the voltage Vpp to be 
transmitted to the line 6 is boosted. At the timing, 5 
namely, time t1 , by which the voltage Vpp will have been 
fully boosted to a desired voltage e.g. 20 volts, the trig- 
ger signal TRG is applied; by this timing, the comparator 
13 will also have completed secure comparison 
processing. At the rise of the trigger signal TRG, the D w 
flip-flop 14 issues a signal of the voltage level corre- 
sponding to the output signal of the comparator 1 3 from 
the output terminal Q as the control signal. In the wave- 
form at the output terminal Q in Fig. 2, if a solid line fol- 
lows after time t1 , it means that the voltage level of the 15 
output signal of the comparator 1 3 has been the L level, 
that is, the voltage Vpp has reached the desired voltage; 
if a dashed line follows, it means that the voltage level of 
the output signal of the comparator 13 has been the H 
level, that is, the voltage Vpp has not reached the 20 
desired voltage level. The voltage at the output terminal 
Q is maintained even if the boosting of the voltage Vpp 
in the charge pump circuit 1 is stopped at time t2. There- 
fore, even if the voltage level of the output signal of the 
comparator 13 changes, the voltage level of the control 25 
signal which is the output of the voltage monitoring cir- 
cuit 10 remains unchanged, so that the CPU 4 is not 
affected. 

[0034] A case where the voltage monitoring circuit 1 0 
according to the embodiment and the peripheral dr- 30 
cuitry thereof are applied to an IC card will now be 
described. Figure 3 shows a flowchart illustrating the 
checking procedure of a personal identification number 
in the IC card. 

[0035] First, it is confirmed in step S1 that the intention 35 
of using the IC card has been indicated. This is done, for 
instance, by turning the power ON in the IC card; or in a 
card reader/writer, it is done by inserting the IC card in 
the card reader/Writer. 

[0036] Then, the error count number, namely, the 40 
number of successive disagreements of a personal 
identification number in the checking of the personal 
identification number, is read in step S2. Specifically, a 
signal for instructing the semiconductor storage 3 to 
read is transferred via the line 8 from the CPU 4 in Fig. 45 
1 . in the initialized state, the error count number is 0. 
[0037] The CPU 4 compares the read error count 
number with a permissible or specified number of suc- 
cessive disagreements in step S3. If the specified 
number 3, then the condition in which the error count so 
number £ the specified value is not satisfied since the 
error count number in the initialized state is 0; therefore, 
the program proceeds to step S4 for the input process- 
ing of the personal identification number. 
[0038] To implement the checking procedure in the IC 55 
card, the CPU 4 built in the IC card executes the per- 
sonal identification number checking program to accept 
the personal identification number through the input cir- 
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cuit provided on the surface of the card medium. To 
implement the checking on the card reader/writer side, 
the personal identification number is entered through 
the input circuit of the card reader/writer. When no par- 
ticular explanation is given in the following processing, it 
means that the same applies to the checking procedure 
implemented in the IC card and that in the card 
reader/writer. 

[0039] In step S5, the entered personal identification 
number is checked against the one that has been regis- 
tered in advance. The personal identification number to 
be registered beforehand may be stored in the storage 
circuit in the IC card when carrying out the checking pro- 
cedure in the IC card; or it may be stored in the storage 
circuit in the IC card or a host computer capable of 
transferring data to and from the card reader/writer 
when carrying out the checking procedure in the card 
reader/writer. 

[0040] When the personal identification number 
checking procedure is implemented in the IC card, the 
CPU 4 is responsible for it; or when it is implemented in 
the card readerA/vriter, the CPU 4 or the host computer 
is responsible for rt. 

[0041] The constituent responsible for checking the 
personal identification number, namely, the CPU 4 or 
the host computer, makes a decision based on the 
check of the personal identification number in step S6. If 
the entered personal identification number agrees with 
the registered personal identification number, then the 
error count number stored in a part of the semiconduc- 
tor storage 3 is reset, that is, set to 0 in step S7. This is 
done because, if disagreement occurred in the first or 
second check, then the error count number would have 
been updated to 1 or 2. In step S7, the CPU 4 erases 
the data, namely, the error count number, in a part of the 
semiconductor storage 3. At this time, a signal instruct- 
ing the generation of the high voltage Vpp is sent, for 
example, from the CPU 4 to the charge pump circuit 1 . 
As described above, the voltage monitoring circuit 10 
monitors the high voltage Vpp. 
[0042] After erasing the error count number, the IC 
card is allowed to proceed to the next processing e.g. 
the checking of a transaction history, and its use is 
authorized in step S8. 

[0043] If the entered personal identification number 
does not agree with the registered personal identifica- 
tion number, then the error count number is updated in 
the semiconductor storage 3 in step S9. In step S9, the 
CPU 4 updates the data, namely, the error count 
number, in the semiconductor storage 3; hence, the 
error count number is updated, for example, from 0 to 1 . 
At this time, a signal instructing the generation of the 
high voltage Vpp is sent, for instance, from the CPU 4 to 
the charge pump circuit 1. As mentioned above, the 
voltage monitoring circuit 10 monitors the high voltage 
Vpp. 

[0044J After step S9, the program goes back to the 
processing of step S3 wherein the updated error count 
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number is compared with a specified value, (f the com- 
parison result indicates that the condition "the error 
count number £ the specified value" is not satisfied, 
then the processing of step S4 and after is carried out. 
At this time, the error count number is further updated to 5 
2. After that, the processing of steps S3 through S6 and 
S9 is repeated until the entered personal identification 
number agrees with the registered one or the condition 
"the error count number £ the specified value" is satis- 
fied. If the disagreement of the personal identification w 
numbers occurs in succession until it satisfies the con- 
dition "the error count number £ the specified vafue" in 
step S3, then it is very likely that the person who has 
entered the personal identification number is attempting 
unauthorized use of the IC card, so that the program 75 
prohibits the use of the IC card in step S10 by supplying 
a prohibition signal for disabling the operation to the 
CPU 4, the prohibition signal being separately supplied 
from the control signals issued from the voltage moni- 
toring circuit 10. 20 
[0045] If a third person enters personal identification 
numbers after an IC card has been reworked so that the 
supply of the voltage required for writing or erasing to 
the semiconductor storage is disabled in an attempt for 
unauthorized use of the IC card, then the error count 25 
number is not written to or updated or erased in the 
semiconductor storage. The voltage monitoring circuit 
10, however, detects that the voltage required for writing 
or erasing is not being generated and ft sends a control 
signal to the CPU 4. The control signal disables the 30 
operation of the CPU 4. 

[0046] Thus, as explained in detail above, the use of 
the voltage monitoring circuit 10 in the first embodiment 
makes it possible to prevent the unauthorized use of a 
card, which is provided with the voltage monitoring cir- 35 
curt 1 0, by a third party. This improves the security of the 
card. 

[0047] The application of the circuit similar to the volt- 
age monitoring circuit 10 is not limited to a card; provid- 
ing a device having a semiconductor storage with such 40 
a circuit makes it possible to quickly discover a problem 
including malfunction and disconnection with a circuit or 
wiring for supplying the voltage used for writing or eras- 
ing data to or from the semiconductor storage since the 
operation of peripheral circuitry is disabled. 45 
[0048] A second embodiment will now be described 
with reference to the accompanying drawings. Figure 4 
is a circuit diagram showing a voltage monitoring circuit 
20 in the second embodiment. In Fig. 4, like constitu- 
ents as those in Fig. 1 are assigned the like reference so 
numerals. 

[0049] The second embodiment shown in Fig. 4 is 
equipped with a level changing circuit 21 that receives 
an activating signal via a fine 22. In Fig. 4, one end of 
the capacitor 1 1 and the semiconductor storage 3 that ss 
received the high voltage Vpp output from the charge 
pump circuit 1 via the line 6 in Fig. 1 now receive the 
outputs of the level changing circuit 21 in Fig. 4. The rest 



of the configuration shown in Fig. 4 is identical to the 
configuration shown in Fig. 1 except for the program 
storing constitution of a semiconductor storage 9 which 
will be discussed later. 

[0050] The level changing circuit 21 changes the line 
voltage Vdd level of the activating signal supplied 
through the line 22 to the high voltage Vpp level. This 
level change utilizes the high voltage Vpp generated by 
the charge pump circuit 1 . The signal that has under- 
gone the level change is output from the level changing 
circuit 21. The activating signal is produced, for exam- 
ple, by the CPU 4. The activating signal is generated by 
a program for generating the activating signal; normally, 
the activating signal of the ground voltage level, namely, 
zero volt level, is changed to a signal of the line voltage 
Vdd level. The program is stored in the semiconductor 
storage 9 for storing a program for accessing the semi- 
conductor storage 3 for updating or erasing the error 
count number and other programs for implementing 
diverse types of processing in an IC card including the 
checking of personal identification numbers and 
processing on transaction history information. The sem- 
iconductor storage 9 for storing programs employs, for 
example, a mask ROM, which is a programmable mem- 
ory. 

[0051] How the programs are stored in the semicon- 
ductor storage 9 for storing programs is shown in Fig. 5. 
In Fig. 5, the address numbers grow lower upward, 
while they grow higher downward. 
[0052] The programs for implementing the processing 
on the semiconductor storage 3 are stored in a memory 
area 31 on the lower address side. The programs 
include the program for writing or erasing the error count 
number. 

[0053] Stored in a memory area 32 is the program for 
generating the activating signal. The program for gener- 
ating the activating signal includes an instruction for 
jumping to the program for writing or erasing the error 
count number in the foregoing memory area 31 after the 
activating signal is generated. 
[0054] Stored in a memory area 33 are application 
programs including the one for checking personal iden- 
tification numbers. The program for checking personal 
identification numbers includes an instruction for jump- 
ing to the program for generating the activating signal in 
the aforesaid memory area 32 after implementing step 
S6 of the flowchart shown in Fig. 3. 
[0055] Memory areas 34 and 35 are used to store the 
programs for implementing other types of processing. If 
the program for checking personal identification num- 
bers is defined as a first program, the program for gen- 
erating the activating signal is defined as a second 
program, and the program for writing or erasing the 
error count number is defined as a third program, then 
the second program is executed in response to an 
instruction given by the first program, and the third pro- 
gram is executed in response to an instruction given by 
the second program. These three programs are stored 
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in such a manner that they are scattered with the mem- 
cry areas 34 and 35 lying therebetween. 
[0056] The operation of the voltage monitoring circuit 
20 thus configured will now be described. Referring to 
the flowchart shown in Fig. 3, the same processing as s 
that in the first embodiment is carried out in steps S1 
through S6. Steps S5 and S6 are implemented by the 
first program, namely, the program for checking per- 
sona! identification numbers. 

[0057] In Fig. 3, when the program moves from step 10 
S6 to step S7 or S9, the second program is executed in 
response to an instruction given by the first program in 
the second embodiment. When the second program is 
executed, the activating signal is generated. In other 
words, executing the second program enables the level is 
change by the level changing circuit 21, and the high 
voltage Vpp used for writing or erasing can be supplied 
to the semiconductor storage 3 according to the opera- 
tion state of the charge pump circuit 1. After that, in 
response to an instruction given by the second program, 20 
the third program for writing data to or erasing it from the 
semiconductor storage 3 is implemented. The instruc- 
tions for operating the charge pump circuit 1 may be 
given by the second or third program. 
[0058] When both the charge pump circuit 1 and the 25 
level changing circuit 21 are actuated, the high voltage 
Vpp is supplied also to one end of the capacitor 1 1 of 
the voltage monitoring circuit 20. Hence, the same volt- 
age monitoring as that of the first embodiment can be 
accomplished. The operation thereafter is identical to 30 
that of the first embodiment. 

[0059] Thus, as explained in detail above, the voltage 
monitoring circuit 20 in the second embodiment is able 
to provide the same advantage as that obtained in the 
first embodiment. Furthermore, in the second embodi- 35 
ment, the voltage used for writing data to or erasing it 
from the semiconductor storage 3 is not supplied unless 
the activating signal is generated (the voltage level of 
the activating signal is changed to the line voltage Vdd 
level) ; hence, if the activating signal cannot be produced 40 
due to a failure of the constituent generating the activat- 
ing signal (the constituent in the embodiments is in the 
CPU 4. however, it is not limited thereto), then the high 
voltage Vpp is not supplied to the voltage monitoring cir- 
cuit 20, making it possible for the voltage monitoring cir- 45 
curt 20 to disable the operation of the CPU 4. This 
permits quick discovery of a failure. 
[0060] In addition, the second program for generating 
the activating signal is provided independently of the 
first program for checking personal identification num- 50 
bers and the third program for writing or erasing the 
error count number; therefore, the activating signal is 
not produced and the voltage employed for writing data 
to or erasing it from the semiconductor storage 3 is not 
generated accordingly even if the CPU 4 should go out 55 
of control and suddenly jump from the first program to 
the third program. This enables the voltage monitoring 
circuit 20 to disable the malfunction of the CPU 4 and to 



protect data stored in the semiconductor storage 3 from 
being tampered with. 

[0061] Especially when the first program, the second 
program, and the third program are stored in the semi- 
conductor storage 9 for storing programs so that they 
are as much scattered as possible, secure measures 
can be taken against the aforesaid unexpected malfunc- 
tion of the CPU 4. 

[0062] The charge pump circuit 1 and the level chang- 
ing circuit 21 are not particularly required if the semicon- 
ductor storage 3 is able to write or erase by using the 
line voltage Vdd; as an alternative, however, the activat- 
ing signal may be supplied to the semiconductor stor- 
age 3 or to one end of the capacitor 1 1 . (n this case, the 
semiconductor storage 3 would write or erase informa- 
tion by using the activating signal. 
[0063] Further, in place of the level changing circuit 
21 , a transfer gate may be provided to control the supply 
of the voltage generated by the charge pump circuit 1 to 
the semiconductor storage 3 and to one end of the 
capacitor 1 1. In this case, the foregoing advantage can 
be obtained by employing the activating signal for con- 
trolling the operation of the transfer gate. When the 
semiconductor storage 3 uses the high voltage Vpp for 
writing or erasing, the voltage of the activating signal 
must be boosted to the high voltage Vpp. If the supply of 
the line voltage Vdd is controlled by the transfer gate 
instead of the charge pump circuit 1 , then the semicon- 
ductor storage 3 may use a semiconductor storage 
capable of writing or erasing by utilizing the line voltage 
Vdd; in this case, the voltage of the activating signal 
may be the line voltage Vdd. 

[0064] Thus, it is understood from the above explana- 
tion that the voltage monitoring circuit in accordance 
with the present invention is not limited to the constitu- 
tions of the above embodiments. 
[0065] Furthermore, the devices to which the voltage 
monitoring circuit in accordance with the present inven- 
tion are not limited to IC cards but extensively used for 
memory cards. The application of the present invention 
is not limited to cards; the same advantage can be 
obtained by applying the invention to other devices hav- 
ing a similar problem. The embodiments have pre- 
sented the examples where the invention has been 
applied to the cards to explain the features and advan- 
tages obtained thereby. 

Claims 

1 . A voltage monitoring circuit for monitoring a desired 
voltage, comprising: 

a detector circuit that detects whether the volt- 
age used as said desired voltage for writing 
data to or erasing it from a semiconductor stor- 
age is a permissible voltage and issues a con- 
trol signal for controlling the operation of 
peripheral circuitry as a detection result 
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A voltage monitoring circuit according to Claim 1, 
wherein said detector circuit has: a comparing cir- 
cuit that compares a voltage based on said desired 
voltage with a reference voltage and issues a signal 
indicative of the comparison result; and a retaining 
circuit that retains an output signal from said com- 
paring circuit and issues a signal based on said out- 
put signal as said control signal. 

A voltage monitoring circuit according to Claim 2, 
wherein: said semiconductor storage is a nonvola- 
tile memory using a high voltage, which is higher 
than a line voltage, for writing or erasing; and said 
detector circuit has a voltage dividing circuit which 
divides said supplied high voltage so as to compare 
the voltage divided through said voltage dividing cir- 
cuit with said reference voltage by said comparing 
circuit. 

A voltage monitoring circuit according to Claim 3, 
wherein said detector circuit has a level changing 
circuit that changes the level of an activating signal, 
which corresponds to said line voltage, to a high 
voltage level according to a high voltage generated 
externally, and supplies said high voltage, which 
has been subjected to said level change, to said 
voltage dividing circuit. 

A memory card comprising a nonvolatile memory 
using a high voltage which is higher than a line volt- 
age for writing or erasing, and a voltage monitoring 
circuit; wherein: 

said voltage monitoring circuit comprising; 

a detector circuit that detects whether the volt- 
age used for writing data to or erasing it from 
said nonvolatile memory is a permissible volt- 
age and issues a control signal for controlling 
the operation of peripheral circuitry as a detec- 
tion result, said detector circuit having a level 
changing circuit that changes the level of an 
activating signal, which corresponds to said 
line voltage, to a high voltage level according to 
a high voltage generated externally and out- 
puts said high voltage which has been sub- 
jected to said level change, a dividing circuit for 
dividing said high voltage output from said level 
changing circuit, a comparing circuit for com- 
paring said divided voltage with a reference 
voltage and issues a comparison result as an 
output signal, and a retaining circuit for retain- 
ing the output signal from said comparing cir- 
cuit and issues a signal based on said output 
signal as said control signal; 
the data written to or erased from a part of said 
nonvolatile memory is the number of times a 
personal identification number is checked, the 
checking of said personal identification number 



is carried out by a first program stored in a 
semiconductor storage for storing programs 
that is independently provided from said non- 
volatile memory, and said activating signal is 
5 generated by a second program stored in said 

semiconductor storage for storing programs. 

6. A memory card according to Claim 5, wherein: said 
first program, said second program, and a third pro- 

io gram for carrying out the processing of access to 
said nonvolatile memory where the number of 
checks of a personal identification number is written 
or erased are stored in a scattered manner in said 
semiconductor storage for storing programs; and 

is said second program is executed according to an 
instruction given by said first program, and said 
third program is executed by an instruction given by 
said second program. 

20 7. A voltage monitoring circuit according to Claim 1 , 
wherein the data written to or erased from a part of 
said semiconductor storage is the number of times 
a personal identification number is checked. 

25 8. A voltage monitoring circuit according to Claim 2, 
wherein the data written to or erased from a part of 
said semiconductor storage is the number of times 
a personal identification number is checked. 

30 9. A voltage monitoring circuit according to Claim 3, 
wherein the data written to or erased from a part of 
said semiconductor storage is the number of times 
a personal identification number is checked. 
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10. A voltage monitoring circuit according to Claim 4, 
wherein the data written to or erased from a part of 
said semiconductor storage is the number of times 
a personal identification number is checked. 

11. A voltage monitoring circuit according to Claim 1, 
wherein said voltage monitoring circuit is applied to 
a memory card. 

12. A voltage monitoring circuit according to Claim 2, 
wherein said voltage monitoring circuit is applied to 
a memory card. 

13. A voltage monitoring circuit according to Claim 3. 
wherein said voltage monitoring circuit is applied to 
a memory card. 

14. A voltage monitoring circuit according to Claim 4, 
wherein said voltage monitoring circuit is applied to 
a memory card. 
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